38f6c479bcd9706b542df0ca7f2e4180814790c11dc9d187e2776f6218bafd67

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 18:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5443f77539e02139cdc7cd7b324e94d7.exe
Size

771KB
MD5

5443f77539e02139cdc7cd7b324e94d7
SHA1

27c2143804edf840331bb99c209c04a736ee861b
SHA256

38f6c479bcd9706b542df0ca7f2e4180814790c11dc9d187e2776f6218bafd67
SHA512

0506ae081841c432f9e5d467532228168faa6f8e401153248aa4db96538cce96f70329b012943f1e2397c0dd5d7636e3d0459848035b522dde428642a50def67
SSDEEP

24576:K/C/7tPquOXZ8xXG0t9DRKb10hJaothZ2/T6FBBB:IIPYXmXRs/ofT

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4800	5443f77539e02139cdc7cd7b324e94d7.exe

Executes dropped EXE 1 IoCs

pid	Process
4800	5443f77539e02139cdc7cd7b324e94d7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4136	5443f77539e02139cdc7cd7b324e94d7.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
4136	5443f77539e02139cdc7cd7b324e94d7.exe
4800	5443f77539e02139cdc7cd7b324e94d7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4800	4136	5443f77539e02139cdc7cd7b324e94d7.exe	88
PID 4136 wrote to memory of 4800	4136	5443f77539e02139cdc7cd7b324e94d7.exe	88
PID 4136 wrote to memory of 4800	4136	5443f77539e02139cdc7cd7b324e94d7.exe	88

C:\Users\Admin\AppData\Local\Temp\5443f77539e02139cdc7cd7b324e94d7.exe
"C:\Users\Admin\AppData\Local\Temp\5443f77539e02139cdc7cd7b324e94d7.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\5443f77539e02139cdc7cd7b324e94d7.exe
  C:\Users\Admin\AppData\Local\Temp\5443f77539e02139cdc7cd7b324e94d7.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5443f77539e02139cdc7cd7b324e94d7.exe

Filesize
39KB

MD5
c33c06c2f1d5c8fa86ef454456de3f33

SHA1
1366206d4cc23a9b856758838ee21ad8e485e663

SHA256
babc2250c926253cc5af1d2d56b73814368f035550d1ba1f6be261b7360c1fc4

SHA512
fae8f62e90a006f6cd81cd9737d1a543b218f2d0f33e05be14900d41b478c638e8491493222a0b4f136798d34af5e7eff63378d60758c74b94fce15ba55fb38a

Download Submit
memory/4136-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4136-1-0x0000000000140000-0x00000000001A6000-memory.dmp

Filesize
408KB

Download
memory/4136-2-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4136-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4800-14-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4800-17-0x00000000014D0000-0x0000000001536000-memory.dmp

Filesize
408KB

Download
memory/4800-20-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4800-22-0x0000000004EA0000-0x0000000004EFF000-memory.dmp

Filesize
380KB

Download
memory/4800-32-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4800-34-0x000000000D660000-0x000000000D69C000-memory.dmp

Filesize
240KB

Download
memory/4800-38-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download